CVE-2016-5742

Critical

Published: 23/01/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CVE-2016-5742 is an SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced versions before 6.1.3 and 6.2.x before 6.2.6, as well as Movable Type Open Source version 5.2.13 and earlier. It allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Risk Assessment

This vulnerability poses a significant risk to organizations as it allows attackers to manipulate the database, potentially leading to data exposure or deletion.

Recommendation

It is recommended to upgrade to the latest version of Movable Type to mitigate this vulnerability and to conduct a security audit of the application.

Original NVD description (English source)

SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.